19d50d3676bae6a0e30454d6e4c2020cf620073507329a636a86f8a575662233

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 11:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fb/adb.exe
Size 1.5MB
Sample260804-m7jlfaycna
SHA256 19d50d3676bae6a0e30454d6e4c2020cf620073507329a636a86f8a575662233
MD5 073b831e08aaea9ebcae0a8fb38fdf44
SHA1 b453c5c7926944cbefe2b81a8b282cb17e16d5ed
SHA512 74b3486bba450052dba940ed47a8d9127334ebc9f5cd2dc6ea7f4828698e4bf663477a50ecef400a6a6a4e73b0770caf30691e5aafc0e4ae06ba09cba13404f3
SSDEEP 49152:HnBLLPqsP3ibg9TPfjBXz0EQqyDvfax4x8EVep:hLrDP3qEBX47r6ix8EVy
TLSH
T1C3758D98FD8755F9FE6B1D708193F73F0B214A01C431CDE9E6A8BD85EA33991111A32A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2980	elevation_service.exe
2744	elevation_service.exe
4124	maintenanceservice.exe
756	OSE.EXE
4072	PerceptionSimulationService.exe
5244	perfhost.exe
784	ReFsDedupSvc.exe
2520	SensorDataService.exe
3132	ssh-agent.exe
3024	AgentService.exe
1548	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	adb.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4b68862a238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	adb.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	adb.exe
File opened for modification	C:\Windows\system32\AgentService.exe	adb.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	adb.exe
File opened for modification	C:\Windows\system32\vssvc.exe	adb.exe
File opened for modification	C:\Windows\system32\wbengine.exe	adb.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	adb.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	adb.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	adb.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	adb.exe
File opened for modification	C:\Windows\system32\msiexec.exe	adb.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	adb.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	adb.exe
File opened for modification	C:\Windows\System32\alg.exe	adb.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	adb.exe
File opened for modification	C:\Windows\System32\msdtc.exe	adb.exe
File opened for modification	C:\Windows\system32\locator.exe	adb.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	adb.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	adb.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	adb.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	adb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	adb.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	adb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	adb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	adb.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	adb.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	adb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	adb.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	adb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	adb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	adb.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	adb.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	adb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	adb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	adb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	adb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	adb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	adb.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	adb.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002cd9ae650124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000047fada10124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004857a2a10124dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc3ea9a10124dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008078a6630124dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000186eb4650124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2980	elevation_service.exe
2980	elevation_service.exe
2980	elevation_service.exe
2980	elevation_service.exe
2980	elevation_service.exe
2980	elevation_service.exe
2980	elevation_service.exe
2744	elevation_service.exe
2744	elevation_service.exe
2744	elevation_service.exe
2744	elevation_service.exe
2744	elevation_service.exe
2744	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4240	adb.exe
Token: SeAssignPrimaryTokenPrivilege	3024	AgentService.exe
Token: 33	1548	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1548	SearchIndexer.exe
Token: SeBackupPrivilege	784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	784	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2980	elevation_service.exe
Token: SeDebugPrivilege	2744	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 3352	1548	SearchIndexer.exe	101
PID 1548 wrote to memory of 808	1548	SearchIndexer.exe	102
PID 1548 wrote to memory of 1608	1548	SearchIndexer.exe	103
PID 1548 wrote to memory of 4816	1548	SearchIndexer.exe	104
PID 1548 wrote to memory of 4152	1548	SearchIndexer.exe	106
PID 1548 wrote to memory of 5744	1548	SearchIndexer.exe	107
PID 1548 wrote to memory of 2772	1548	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\fb\adb.exe
"C:\Users\Admin\AppData\Local\Temp\fb\adb.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4240

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2980

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2744

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4124

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:756

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4072

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5244

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:784

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2520

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3132

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3024

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3352
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:808
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2832 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1608
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4816
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4152
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5744
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2832 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e980e66c5ce7c5632ec40db0c0910100f8e64444b410d75941a622924326b3e0
MD5 39a7119a3d66b557b3c8b44a04a0528b
SHA1 1d2693f50c45abe05111636f124e0c9cfaeb2877
SHA512 001c148e9d151e70ce29e801f4d220d4396ea22107db59e1456558cb1b77a01815965150d16aa5652b7644ee0ad535f7d9d6a9236c6642e301d2faf6d3900820
SSDEEP 49152:Sb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnVx4x8EVep:03q6HjBaix8EVy
TLSH
T108D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 13ce009d1e93d23ca3bae3738ac2ddbc5a610022748f55ee4110ef965974ed3e
MD5 d900679b9498be6db8317c09437c9126
SHA1 b1f969e935686e3dbe2bb640883db985565fdd39
SHA512 9c4915c784751b166089b835f88eb5bab5fb32b74737a2e0ad56f0405c11b2b95d6ab8ad28e02a9559ac0a16181c18090fc1e01056161174bc8eb2a50bbf1118
SSDEEP 12288:E1XLsswWkxy2lRq2czAr+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:CXYfDtczAryxknw4FYnshx8OfVe247
TLSH
T14675F12877D508F9EC6B8139CDB28512E633B8554770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 5e06ddd4843e84186db66a8c850603a81453a394e74f229ab74ff442c32d6f82
MD5 88f5295a86d23cfc5789a5b405f00707
SHA1 f3a955888d5af45098669cba3e9aa9f9599e5cf4
SHA512 aac83d61dc14f1f45859afd528f17f81c6b687159a1119c947111c0afd66ccd86ae4d93b2c7116574e6acf3f5c57ceb446aed0a7f557d6b933953d438fcce6b6
SSDEEP 24576:y0Le5ji0hmxFrMiyxknw4FYnshx8OfVe247:yPji0Arox4x8EVep
TLSH
T15195AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fc041295c987e3481f7043e959279af9270988337415da5a271979029666d0b9
MD5 8371256e94b87809589b7230498846e1
SHA1 9e3542e5b5d9a60b3f3f0ed2707d2223409c82f5
SHA512 3fb110d7a8cbd3862f0123c3f201c5ef0052d4fe27aa33bd873c78dea2c553a950e8527ec242be2e98d953da54f14904589eea0c2957b1d60f2ba7c7c8d4dd3f
SSDEEP 24576:Ca7/ezSC6vUyD/aqgrvWE6q8wyuIyxknw4FYnshx8OfVe247:l/ezSC6vUzPvxHjycx4x8EVep
TLSH
T113756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6b5926569ba25314cc830f986352427fec0dccf33153f77c6271945ff012d51e
MD5 811965297c129b191d822b3d38f45584
SHA1 0f3eaf9d24e78043a2666087572765714adbe640
SHA512 54271d5fef1fa2aaa184a821b88bb1bda462ac87ef75baa50dd4c261aab1935abfeb89c9617bfaf6d9113a2af8f6b1d91e24bfca93f10d4aeffabb253967108b
SSDEEP 24576:kVbqPb88hv/l+6/yxknw4FYnshx8OfVe247:kVO88hXl+hx4x8EVep
TLSH
T13B559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 67b29f57561e4dd19535d4105f7567890642d02027d6d04c9fac1b4cf6462044
MD5 8d52217fc765ec2d9c92a06172cd7904
SHA1 9e3e6fc03373b190ea543089b7032ea9e67c216c
SHA512 e49f8ad1df9ce47df3917e29548c27e3ca65b629ab584bc06c6edd6b6b0c45ee41e0995f125dc2352468330324c0d8c4a985831281431adedaeee281c7169a88
SSDEEP 12288:VNG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:VNGyxknw4FYnshx8OfVe247
TLSH
T1AD65237CA7DDA4E1FA5E14331B7572622616F9A4DA74C11BCB78B14EE0F0C60E06E223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 e6edb8ea7f52c389441db63a6f4d96525e210f41cba862dc6558620e069b772a
MD5 3bde50bfc692b08143bc1e2e17fd1eca
SHA1 2ad30065949e7b6aebc7949db442b2eb7b08dd0e
SHA512 ecaf93359332390c524ee5a340a2724166e86686ebbba076106296d14adb1d35536f5985e52bcaedfadb0f1f5e5eea60a8436b2094afa1b9a81ff447d224a606
SSDEEP 12288:BeBNUbTVO86Un+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:BJIUnyxknw4FYnshx8OfVe247
TLSH
T18675CF7BEE28FCD2C27E5DB95B918200A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c821547eeb7a2b6fa3a51235a51bcbca12807bdc5880fe81592ae9d359068f97
MD5 7355a7087dcfa751056de8395b4b76b2
SHA1 b29b6a51a2eb8e31578e5d87722916fe050652bf
SHA512 7a1c34bb805c10fe2deccaae596124619e91dcf0e93b91be9b3e01079e00cb541677c99fa19eace802c1bc6b90a8815d8488f9730d8ac02f4046e891983bb491
SSDEEP 49152:HQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THY:HQvGAdlCEL8c/yRNw5C7ix8EVy
TLSH
T158267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 c80f1fa8ca36e6e89fcb691cc7fe40339e7d5ade6b9b33ee00295bfd79ef171f
MD5 7798b2ebbd47445cffa22967194f0fea
SHA1 6f0fba2b09987b3290b55a325dd6f73c3a432e0e
SHA512 f80de1b79794d5d27116cce4ab4441a83615d1a723c8d310496e33d693c70beddf7823ddbbb739c4e3959c1c6199cbdbb52fcffd72a3e0e1026a98368c1a282e
SSDEEP 12288:YAwSfxL/2Dc3LDLLmt0LDQewsAjN+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:96ewsAjNyxknw4FYnshx8OfVe247
TLSH
T1D385E030FE74E032C6BF0DB21B36D716142DB9604B611AC3E3F89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 86dad05b8977045f5d02d5ffe955a636b3fb871475fd4aee7d68db95aa8cccb3
MD5 ca6f4e6ca159f6c4bb4f9fb972e5aa79
SHA1 0f277a66c5c88a430f55637ce12a1cfe524e058e
SHA512 e04d88f06a3d587e1be17573f791e5d925e0182bdb58012ab3e765a0d560fd371ed084c13ee06277936349da41b465704e85283aa9703a1a3507b7f9d84c49a0
SSDEEP 196608:8UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHd:8UEtQevvqc2W1cpV2EI32
TLSH
T1D4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6509b5af2f104bd187f023c03d53e4b5570b503d60fed4265a9da37a26f0fa22
MD5 86e11466287536babbe8aee556a4f5e9
SHA1 feb66103e2a328b41a543af9494554d5f40bb7ad
SHA512 86544a3f9b521f3abd00f198a70fa372353c19535c8b5414d9eb52cd55ad285b6685ee8d5fcf945fc66d29f0589fb0639ac22cbcf8e8c22afb89bee924bfb8ed
SSDEEP 49152:UCbRquA/m2yL5zQfFiV+XenmE3/zYx4x8EVep:9oqtVjnmfix8EVy
TLSH
T101D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 28f1c00b55c6e6266019f49c0743a5f91546ce7d6dd9a2a6120d1d986e115c61
MD5 e5ffbfffb481c7294c45cf6bb0bd86fe
SHA1 8c41d2861a92c1b9e0c2bd9e0500326e8bae9f1d
SHA512 66bada0beb3fd85bb182dcb5557a12e033ab59f36b0851fd13daebf1628509a4e62a7a7f03c445c4bf995b947e9bb82e04836c00cbe3d614af05b21e724c4efa
SSDEEP 24576:1AhGLJIFoiwtA5l7S53kyxknw4FYnshx8OfVe247:1AMyFoiq5vx4x8EVep
TLSH
T1A735AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 8a99172dca86b8bef8fcc56d7790de107c860f7169112c11365475fd38f095e4
MD5 0c70969e7b7126f5a9f48e09ab699bec
SHA1 7d7d11f47ce3e8a9ab70aa8f65bc44a5ab32f98c
SHA512 f4cdbb0630a2ecd307491afee31f5c826430bf3c3d04bf2c050c15286dea7ee37c1cd3e770865d1d1f2d107558b512d5e0219da9b031e70ad1f9026dc613402a
SSDEEP 12288:Vmw5HEjsChNoBFgl0WDm+Co+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:QwuFOW5yxknw4FYnshx8OfVe247
TLSH
T1E775F14977E81CF9E9A741398657D136F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 e7086998eb3f6685e1ca198a8f09c9e0a07b259949340e176dc0a5e74efbe173
MD5 9fa543902a4cec675760ee2f9c9c58bf
SHA1 429bf0f990c75b1f334ef484fe57557ed83f3b3a
SHA512 7e5788a443ec6ef9ccafdbda904cc43e172965cb32076f1c1a5637f38879e390a583917e0bcfc6d31b268fc28cd4e2e1910737ed4759c16e29952f4085926947
SSDEEP 12288:DFZ1Iyd+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ZZuKyxknw4FYnshx8OfVe247
TLSH
T11C6512AC33E860F1E1A7113A89F15205E76274A2677183CF4768625EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ba94c51251659c91699b3db3c8984ff3c3fa05d10b9165f612b51b0d95f06c02
MD5 4b51061d1b8b200b02f5e3ba03228fb1
SHA1 0fe96962516f31a6f5e6325eaf371f71fa7e6ff6
SHA512 9cad9e8e086f24cfde65cf31ac896fa0d01623a24d61cfd5f25d243082aa2fb517419c69e4f21bbdea81208505c83fca52b990cf1e75d120bf9219a26604ec3d
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uk:+QRQyi36YOcPQLvw2gAf+PN32ix8EVy
TLSH
T13E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 446768c54ad9933e70bff0813887dd88430e9a425b182e350aca89f99b05e0d4
MD5 c196e8f02eee849a380eff2f76947821
SHA1 edaa96aed582444793bdbc8e8bcb7db921a433d9
SHA512 a11533e89f88dacdc7af2cad19d699e4d67b72938e5567a983e87936e1f6d990cb6f1872718acf4c0560791fae0521fbc8d8519b9bbffede3b65eb666bb83db9
SSDEEP 49152:tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uk:kQRQyi36YOcPQLvw2gAf+PN32ix8EVy
TLSH
T187667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 24644ac6a1d519cb5f6e178ee6c3ce71e1c0def79beeb73d78c349f79fd27723
MD5 3062244fc2e4a5457b64e2bff1226e6e
SHA1 82ba06462b6b8647a781268dc5797c39852aedae
SHA512 0bbb83074d321b9b95cbe6bdbbe397f023ab5433ae35529caaff8e975395f0b5369762028d7d69a2fd92bd6c18a1e4aa0d42567a7a4ed224bcaa9af3a741ef17
SSDEEP 24576:ZwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL06yxknw4FYnshx8Z:F68Qg55nhheWu7PNU3/ox4x8EVep
TLSH
T159B55A33B2F600A9C44DE1769F46973196D27C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c9be1d613cd5fd6b7c1110a02b096a2f091272e7c6e82856a47802b4a1c39543
MD5 c3ad03162a8f2d9928259845a4f5442e
SHA1 9c9a29c8603568a58b60722d36b33133662b8b9a
SHA512 a54909dce7890b21cb2619285812dcbc26e4de023b4d01b74e08e9e05e5d905008fcf61990918e3e1416ddf371824290062fd2c4f9a26409f90893ccb1e62a89
SSDEEP 49152:p3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk992:4y5112gYy5azzVvL69nLKnhZ5ix8EVy
TLSH
T133167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e07286b48a4ec6dd13a0316f846579515d92037a24756181a0d21bdf99ecf9fe
MD5 78d6fef3b84ed1f070b22eae676f8f0b
SHA1 2b1f6b7f8ac4382a85c86e7c4d3412cfaa307a65
SHA512 35770c5b56230bfd162df626ce6cb2336a2bd5d248ea5c7a6f5046442426838488d2c5981b176e3be65128e69813a3d0c78b4cf262757dc68bdaf454547d867e
SSDEEP 49152:LB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl+x4x8EVep:du6JmVxd2d+ix8EVy
TLSH
T150D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8317042bbea2c00bb988121d189ed5ae9c44405928889581b3ef303600081f23
MD5 81cf300bd143d07f7bb305b6dc463293
SHA1 8e386f81ae05828fe04c1f054fb52588ac86eee6
SHA512 8aa444507d424fa0313b7f72193d4809d156fc815a36d60afbc05e8a431f8f7d3377078cc48a93070f3f304ce40b13881c7b73c61fe4384f5ee1954f14484294
SSDEEP 49152:O1hpsNoJpF1A6UU44CwH7R4xSx4x8EVep:OmifPbRfix8EVy
TLSH
T1A4B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b294353841b9c8ec74874d973083be8d6602559561555fd01a73db21cf59bf84
MD5 865bf51ec1a7f15786621238b8fce504
SHA1 25af05f0bc5b561f691aa1b06bb4d6651aa74d37
SHA512 21a6e4e06de30c93734f73d0fbf91c7d536fae04f6248166165ad711857e260e290e167161b03bbbdecd2a86f250d2ff1939d221d8740757db12be52ee6cdd41
SSDEEP 49152:hSuZQIY0Be2KRRVtOnks6NMHqlx4x8EVep:v5dKTi61lix8EVy
TLSH
T11CC5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 00c5ba245ca857aeb6925b49539a772b1947fea1464a1ff78d074b9e53ff2455
MD5 247a255ea7d989546e5b309a69aa71b5
SHA1 f58133b2f2b24536a80a69664a216f059fce975a
SHA512 9b2e86cb00b38d1b04d56511123eeeca1ec1ea042cc8c7a6678d19d92abff91b11fea3dd3af9759891df359dc1f6ce5486f29d6e0e2002c000ee45c6772460f3
SSDEEP 49152:EhtSn8EApI0figngiDn0AP5wOx4x8EVep:FX2iyphTix8EVy
TLSH
T1EF95BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 84ede7009f4cff6260be83afe5e95c2afb38cff7191cb5ea0d9be232c9239561
MD5 bd22e0faee44970695db864f6e1c559d
SHA1 e27a91d045b1e58d39334ba2d97d5aa0441034f1
SHA512 c7ef57a845f0613f7f7944a0f625a0b18be9da2ede3f70c82ff4744c50ff3a16a054175c828f834010e9b56329df866ff6deec682f4fd5db1ed3569084074300
SSDEEP 12288:8u+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:8uyxknw4FYnshx8OfVe247
TLSH
T1E06523BCBBDE95E2F50D11734A7173626609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 44dca010cb24584616339b254c819054dd84b19d2dd8b5450a2650be488e1718
MD5 5025b9ff7f6662460a11ec244bf0637a
SHA1 d22b8f8d3bd1eeaa0dfeccd9ab6b8e4069522c4f
SHA512 3de0ea4a463e22dbe410de66be30d2767f18f6b615d3ec49b0620946349c8bdd3dc848d080c1a01a70c057da51dadaa0248043c91ea7ae3c7f2e5acb43609c58
SSDEEP 12288:6x+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:6xyxknw4FYnshx8OfVe247
TLSH
T15765237CBADE95E2E50D11734B7172626609B5A5EB71811BCBBDB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 93c31f522b0da1539a8b24df2593559f55eac4f15956e6d895c83b07041a8196
MD5 addea5b02be4f29eed81430327b748dd
SHA1 7e36a830d206482274af7703517ca3a6576ea2f4
SHA512 aba529d97d1f39ea7330abe85499884a4d4a10209fe3fba5f2d183828cda0801efca06e3d0776cad54659da9ab2979551def71c8e2f1cece22641fe7c4798aae
SSDEEP 12288:6v+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:6vyxknw4FYnshx8OfVe247
TLSH
T1A465237CBBDEA5D2E54D10734B7173626609B5A5EA71811BCBADB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 26247fee51f2d89a591e10b82dc462dcc365ca78a21b540b2dc7f0a35f81235b
MD5 b7d7c19a76a87a2943d05b93c06bbf94
SHA1 77a145e934f83cd7cfba7ba6643981e76e8f2a22
SHA512 bfd8746cc82da927855349359d90231a6be0fb231df984a984be5656ed39b26ea9bc647ff6b4a1e4a4ef3ffe8cb1003e1bd19facbcfe935558e6452ba770e1d7
SSDEEP 12288:zVE+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:yyxknw4FYnshx8OfVe247
TLSH
T13F65236C77EE50D1E85A51738A726222B365B8E5E731835FCB64700EEDB0890A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 ecc586e8426a5d3b791ba9168ab625fa0a2cdbfe0be8051aebd7dd2cc125d8f5
MD5 c944104216a4c4c93dabb65cfd8de8e1
SHA1 3c984dc4542c03d5c2b008cb4ad9f3b1e2025770
SHA512 c7bd70ade2c1fc012e8d1bbe894ee6110f7f8d1482b56ab6a04a83823d906fbfabea5cc3da5bd0697a22c890bceaa57e80fd77ad6d87b3783ec31259bf2bf362
SSDEEP 12288:Lc+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Lcyxknw4FYnshx8OfVe247
TLSH
T1B565237CBBDEA5D2F50D10734B7173626609B5A5EA71811BCBADB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 13f662fd41b2102d64681bb13be7de9d5f31f0f8d1474b4af901d8333c64f2ca
MD5 b5544a9098c32a070cd85ab0f4ebafb0
SHA1 fadaf4163ec0bc17d9c15578571e9e665ecdd68a
SHA512 d86de076a84f80ca9f320a2b20120de5bc775b0cc489ea77ea304f69d41d0034f5903cf5a0876293f5926074dc10507269be453993ace01903c1fcec31442ae2
SSDEEP 12288:+V+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:+Vyxknw4FYnshx8OfVe247
TLSH
T14065237CBBDE95E2E50D11734B7172626609B5A5EB71811BCBBDB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 e4731b31f0ecedb00c11d42485d42c3ca2076a49e1b5b7aadc574222ef925ea1
MD5 0ae7d3842efb228e5ce11fda1b040595
SHA1 d2e72df2759675b10a495534f388b50133094692
SHA512 c8d2f05750732b350de63dedba0afffcb85a501b23bfe9cb1f7f391b9c8125889893eb5f825983f2e9f3198221e4fcde5e4f93625b28c52332ecc050eef79260
SSDEEP 12288:ap+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:apyxknw4FYnshx8OfVe247
TLSH
T1C765237CBBDE95D2F50D00734B7172626609B5A5EA75821BCB7DB00EF1F0CA0A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 bd4bebdbd416239cb78e131a6c3c89250d59a395e7a46a7a57f919b6ba8ab164
MD5 5d1bb082de4f54282a6cda81ecd8d4f6
SHA1 326c25246d4cadc094798803600087cf58de6a9e
SHA512 b9c7578b4459af69cf5eb943859115d8c1be11bca7fd861e2a5d73812ca514a1150b0f521bb48b1030310053cb3ad77d3a38d29f8621792e163fb9f0025d8837
SSDEEP 12288:9iZwbZzzFEoS2cPvyR+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:AZMdzFVSORyxknw4FYnshx8OfVe247
TLSH
T1BD7502A8B39018F4EC67413ECD259916D6B27C594B70C21F43B8362B5F736A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 7b8536046fdb9c6b8e571be798875f64e277bca54c9569fb888ff3bf43c51a33
MD5 8e59bdbb9b5ff64fd331109fc411f400
SHA1 2fcaa88f07e17ece79512f7dead951c122e907f1
SHA512 8f2ebd61a15449ecac0cd83de21ef0d5ddae0c8606e61ef85e175397c56ac6c144097dd1d69133670d7e8f549898a89564636a4bf88b829e9136654de628f73e
SSDEEP 12288:5a+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:5ayxknw4FYnshx8OfVe247
TLSH
T1096523BCBBDE94D2F54D10734B7173626609B5A5EA71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 3ce0c02b7ed1e5311b8c34cafaaf1e8e7118ee4357c037037b05c52606ab87c6
MD5 fe9b108c9815efd011d5deceb5588807
SHA1 b6d34778a954a0209f96470bcafe8520ee47aae1
SHA512 be90bf61eade3ca726ac0e5a1e4c998cf654bfa53ee032a1ba5c6ca5fbd4a5729a7073a6f47d0b9673504a47e507b92c9efcde1c573cd612fde076b324138c97
SSDEEP 12288:PW+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:PWyxknw4FYnshx8OfVe247
TLSH
T17665237CBADE95E2F50D10734B7173666609B6A5EA71821BCB7DB00EF1F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 abe4ff29a31caff8f826d0f26270f9d9157c122bf6b81c26c8e0df171222983a
MD5 556e1c2cdbc4d7a2fcebe2df00ac680f
SHA1 0304a6a0a1ca4da41152576daffe7657f1f20268
SHA512 49e52e14fb3e73ffe30eea6bae2ae02e994ba95a1c8ac65c3c2a777e6d7b40745f84e99bd789bc06de7a12a362d468b53014debebc16688f6a47746d73db96a6
SSDEEP 12288:LyPz5L8d+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:mzydyxknw4FYnshx8OfVe247
TLSH
T14075125B73E530F5E13A4236C9621602F772B872473086AF87A4527A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 4cb8fc2c7aa408725d65c805d35d5f8f8866cc757a81b2d89f8f873491c7cfb5
MD5 e58efb428e8d233a30c3d8acf34414e1
SHA1 b5c41647a2de67e0aa7b9f380419863345448af4
SHA512 e7e71ed4e7505181e2be06d165e2fe46b2a3bcda74a4aae3b8906d97ff5c49204f2e0fad814b9ff32527ba02eb8180a1cdafd195fc44ec29c74e99c890fb5bcd
SSDEEP 12288:Pa+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Payxknw4FYnshx8OfVe247
TLSH
T1EB6523BCBBDEA4D2F54D10734B7173626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 23eefe457dc717926860219fb8207280d8241ca8b711e51bbbcfffd39a0526b4
MD5 5dc2954916d054c84c16d41c96ad701d
SHA1 efe1a522579e80a089f1974665782c391c3fdd7c
SHA512 9b7ad793f9ff1faa5dd8c4cd2bba239fb81ebdeec91bebed7edefc21c7a7313f9fe4f8e608b275bf64c4577488438cb54bd9b2be1beccb67a007019d44bad3fd
SSDEEP 12288:Va+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Vayxknw4FYnshx8OfVe247
TLSH
T1046523BCBBDEA5D2F54D00734B7173626609B5A5EA71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 84a2c192b3f9531e895eecb54252ece379e48b14afcdfbf540ab95ad4691ece0
MD5 f308dc2958379de325d46c1a376ff938
SHA1 6798da61af07e996cd87f4e814f55bec7a690a91
SHA512 27579f1a59afe2d32a7ed78733cf662361fc5a5d12016abe07b2c17aac3247aa3fe3d16157f17588965f4dfea53464971d145bdb7acde75647bac5f8566b86dd
SSDEEP 12288:UyPz5L8d+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Nzydyxknw4FYnshx8OfVe247
TLSH
T17575125B73E530F5E13A423689621602F372B872473086AF87A4527A6E735E09D3FB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 2cc69c2a34f04d910c3a2aa91b4961618c30d74cb34fb3a11cc728314db69edc
MD5 eb762f01a3bffb34c6245bdb6db08e38
SHA1 0ec6ea949671e6dfe60d5e13a34fc53bb64098c8
SHA512 60af25445558fcc40a7ffdef98c66f05a7d4450fc090f48b8a9f99f7ac1c1db206279d719ec9de1e898a2ad16eb37f11ab3194e3411b5974826872c92e4b3925
SSDEEP 24576:rTGaLl3z0zDfyxknw4FYnshx8OfVe247:rTFLljrx4x8EVep
TLSH
T1B67501A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B9F736A05C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 eaa124126b5e9dac7fba3acea741b1efd987febc85969debf37c368d627368a1
MD5 d33e7fbc165c23ff0e56ed825b0689c4
SHA1 986ac47d6adb90f0126c5d44efbc37b4a96ae0f1
SHA512 f5a1230082384e849b3150fdc87f0fa0253cf2018ddc0c79b0fc3c4385ead0551d6b508d4c503ea1c6efb3c12adb5d94700897a6c3c9a370a72ed0f0e046ae84
SSDEEP 24576:H3nd9CHKy7GZTyxknw4FYnshx8OfVe247:Xnd9CHKyawx4x8EVep
TLSH
T1B895DF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 e0209a54fc88c52d002bf86b3132098c70837e6e5c962f231e0e2ecc553d72c0
MD5 eae1ad87ba3a56585c70b022c6fc2cf7
SHA1 fc292a416d1d69d5fa49444556fa8b2596724716
SHA512 d8188f972b93e19fe6a66f1173baa0bda11066c7284bdb658f906334aa5ec368d11c7eb97bd328622a8f8bc3754208b1948f5c2eeef43a7dc579a286cb354270
SSDEEP 12288:BP+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:BPyxknw4FYnshx8OfVe247
TLSH
T19665237CBBDE95D2F50D10734B7173626609B5A5EA71811BCBADB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 bf4ec494c3eb365332d952e4e91e88b15fa20c5d7f451b5163b2848e8f2ff24a
MD5 aa81650e5f91cdb2bf3a62319a5bc291
SHA1 88115675bf47c4e13043699894f4e3e6404ff490
SHA512 e5f27eb040bc3fed5e523ebeca709303e48a0d0dbf2d595ea5e977b8e03679b30f6b8f6520572ed0a64493820a08f16e9bcb44f875bbf395b641ac23e21ada2e
SSDEEP 12288:e9+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:e9yxknw4FYnshx8OfVe247
TLSH
T12665237CBBDE95E2F50D11734B7163626609B5A5EA71821BCBBDB00EF1F0C60A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 7b28bba86b0fbe36147e0631c5032cffa3079c067ff80eba1040510406e310ec
MD5 f3d6c0fdb0db7a15ccc14bb02047f99b
SHA1 f64c7262e2284d59d628d096b9006db95167dc7c
SHA512 65c7b3ba99be691959e8d7b6bf803bca8d34b43f95175abe5b1920f43e461920444bb95a48e20c399d869fabac9aaaffaf7eb240b6f060164ba9a5213f6040ee
SSDEEP 12288:rg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:rgyxknw4FYnshx8OfVe247
TLSH
T1E26523BCBBDE94D2E54D10734B7173626609B5A5EA71811BCBADB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 76a261f71cf225f46ff938812269fa1b0372bc888ad62aead0c9c4fada90b4b0
MD5 6bc43a1f58f1da3d1573f7d8c9e0d584
SHA1 7f6cbfcf2f426afb7785559bc7c5980a82c81839
SHA512 884b6657702d4df145c6a1ffbe4e15cdff3d60711cbc1f39e8b727bce33e098c1cfac8276aff69db0ffc36212292ae020ac3a8988c18c3e9e93c98fa2b96f3a5
SSDEEP 12288:Ca+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Cayxknw4FYnshx8OfVe247
TLSH
T12365237CBADEA5D2F54D00734B7173626609B5A5EA71811BCBBDB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 95f207da1bd1e41db39046a4946c0520c7dccd38f2f9e53fc7e667ba184f5a95
MD5 32bd257d926ce4bbac16ba78369e870d
SHA1 82d7a85f5a7ab78e905bfa64cd38980e2641ab0c
SHA512 4c1302945e0c4f1c4732ed3bb870162c511e15d4d68b6db1e62d7a10c131117a99f1e9236b975ce0f76cdaa8bc1d7812aba73ec00767e09a283322ca916b95d6
SSDEEP 12288:xP+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:xPyxknw4FYnshx8OfVe247
TLSH
T18365237CBADE94D2E54D10734B7173626609B5A5EA71811BCBBDB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 ba6e09ec58f2b5922a5ffe76ec4f934d5b7c8b5f4062ce9e8ae74ee0ae71f532
MD5 aab25fa17cd9f091b60568ccf1101624
SHA1 4c774c31abc69763b433852698c81e796f8c5bbf
SHA512 1c438ff6de93aaa8626b2dee56d76eadc9efa88e5358b6f9de3cfc161a4ba37b089c6475d2affd4cdd2272d42d4c66887a29ca1703cd404a2823c0b84b28ed6a
SSDEEP 12288:5S+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:5Syxknw4FYnshx8OfVe247
TLSH
T1D565237CBBDE95D2E50D01734B7173626A09B5A5EA72821BCB7DB00EF5F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 56b44ebefb2c0eaffda60655d8a16689be6f2589f24d415c278a9253cd60205d
MD5 9201ac4a8d153e89513d19ce4ee5ba45
SHA1 914bec5e04026f7a72c51fad3eb6186533e84e44
SHA512 93a178fa1dca09140c3466039e01e1772f6dc9ec68ee2993546cd28681b249870970f075480268f21d9aaf3d6e26bf82c2144db27155616c9f28a5cf64c6ed30
SSDEEP 12288:Ec+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Ecyxknw4FYnshx8OfVe247
TLSH
T1426523BCBADE95D2F54D10734B7173626609B5A5EA71811BCBADB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 6956602aa0056c75cd6efbbab653ea014c47c6491f60fa198eb0505728d6a5e8
MD5 0ff0048834a259eca2164646f3d55d31
SHA1 6acf5bae0668f2a9bce9f0f79a8211fc1971bc4b
SHA512 77d32e2879f9248504942603c5cc733fa1b60e5633c047dc4b1d9cbccc8fc9731dee1210c178850f0eb4b97b8599fe9048fdce5c7ee1c859ebcc51a536c0adab
SSDEEP 12288:A3+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:A3yxknw4FYnshx8OfVe247
TLSH
T15B65237CBBDE95D2E50D10734B7163626A09B5E5EA72821BCB7DB00EF5F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.4MB
SHA256 d71ff409774439c4bebfcd80686b6f0abf7336d38e98ab7edce5d9db2d5038db
MD5 c46cee3e7c8b64687a4953284317b1ca
SHA1 2948121e153d02228a0793a51dd5da0271d2d2a3
SHA512 3056cc7a89c0803110bc0bd2c47cb4ba229e5a8dcdccc7cb4cab25ec41b474894a2e4f4b58efd68c5a4c4b5a3f4ebc2c7e80fc4591455415ea86a69a2234e169
SSDEEP 12288:7c+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:7cyxknw4FYnshx8OfVe247
TLSH
T1A76523BCBADE95D2F50D10734B7173626609B5A5EA71811BCBBDB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 50bca70346ec22c2d31e05f41f577b839e9b7c9f5f52b7c2b90941643f8f48a8
MD5 ed7b13cae2db84cbe773f503fdf4790a
SHA1 2805f0f3aa9301fab18829c8f43d4da1f95869e8
SHA512 a2106a31ba3b3f3d09bf4bbf7ee92b83a8ed72b05a2e2aaee416675e107c42cf069e2006c03ef77eab8c19bcf548e8fb7a78aeaa027bd6cb411c8f2ea28dae8a
SSDEEP 24576:/fwvJk9RX6wkyAImyxknw4FYnshx8OfVe247:YMnYIZx4x8EVep
TLSH
T17595CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b1fa3c8a5e2ae849dc89545e59a2c0a65035d328eb0a40d57f5f25cdc7cf4a6c
MD5 8c4578355475faf57741b48ce1503a2a
SHA1 f47a55275f6082192d31fa2ef589bbd0d56507e7
SHA512 1d5f7223f074cbcb0e3951c919c2849aad380585fa29239e52af62c578a8c7eb85191c33dbe85695bbf475e047b5a9802d3cc3974b71c1389aad5173ed0eae2d
SSDEEP 49152:gYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ux4x8EVep:OySzPWix8EVy
TLSH
T1BA066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 2fff410a75cae689d273b673b92f399d9a19054eed0e6ffb5b7db1a7b2d50fc2
MD5 c0cd91fb173fd247b6f7dbeaab5bee0b
SHA1 f4de16769a20953030f81e8338b60f3cc14ef7fb
SHA512 b1a545dfdb084306882b23be20a4f6b1c2f0755d54e809ef1fa99ee84d858348ee238fc6c43e0c2fc637845fdd26cb6790ac9f69b8fce5615a064b8ea7cacdc1
SSDEEP 24576:E47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYhyxknw4FYnshx8OfVe247:E47JUQj1irIhCnDHUPfF/+x4x8EVep
TLSH
T1C665AE1DA3EC01E5E1BA927885154A1AEA71742E1F31CACF1270837D6F63ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 74b0de0e130162aa85e79cd157e5f9a3254e23813d44e5d00ed6d1d9d1666148
MD5 1e271ac6c02e1da90de3cb37e4b95fe6
SHA1 b1c138f91ce63403b5668d4c6e4f8095543a0e69
SHA512 0e72ea0dc9bda799b33c70889ed8c8ad34515efb980126fc35bb2cf9c222058c4800a3336e496a122b9f8b57d7735672d8e998c236535f42bfe3984b0bf6eff5
SSDEEP 12288:Q+sfK+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:gKyxknw4FYnshx8OfVe247
TLSH
T1C275F028E29842E4D06E2136CB625641B3237C6597F1D3CB97E0F53E1F71990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.4MB
SHA256 259b2fcaaf4418635fffb139821e99a69409eea1c0da669ec1876d4182f4d23d
MD5 b029f45fba07eef2427c3b2daa959962
SHA1 23d825c8c50d75eb39ae75f4a309110f85df6f31
SHA512 547992989fc3316b7e9aefd7bffc8de3efd86e5d7c55fbf4c26013e71d8b75b0768d2c32c725f074f7d7dcf487523a14f9ad9299077f571de05f0637c4086cae
SSDEEP 24576:/vquIhAViPsj/XyjSAJ2SGpjaZNbbMBVds:/SZhAEkjXyjSAJ2SwSNbbMBV
TLSH
T18B654A51762AD75FC6AD40326E32D2CCA7707D05EE446F0373C88B3F9576668BAA2381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 a296d0b7193c4d7b4bd1ad40157bc3c8b0dad0f4eebcd250b1870e02fbda927c
MD5 645f33cba6ffdb14a2e394f548f19e7b
SHA1 977059bf49fc4ec4e14661881125c739c6a78c33
SHA512 67e557b726a164301502dee8a00c27c73de3d19a5429d6f2c49c952bf025cf65c09d03be006016a06b45ba7acc3305c3470622fcbdb1e41e93c70cb31d0cd828
SSDEEP 6144:WwhkMmXyjSAJ2VABv9LH13xaH1Ql6GIgqKDexHPgqKDexHJEMvvsXL1c1vH+9:7kRXyjSAJ2cVxplugQgzM6WP
TLSH
T10A6509816537E3DFD1F750320336AA8CA764EC06B7496F26B388453AD46A725B0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 b41ddbca5bbcabad5a61969a700e06c22f3905f109e8a4441efd74bb6de7d38d
MD5 89b158fa4e8e3fe8a88d973d8026e441
SHA1 b94f24d912b45f6421b62d38a239b7e52ef33524
SHA512 55138df42bf26431ac998b7a988b080c888e12fcc9b34f2562b48545c53319c8f56a3bd3973833940fb2c6be3a5e05c4dc8d276430b3348db16933a78a971cf3
SSDEEP 12288:W47C+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:HCyxknw4FYnshx8OfVe247
TLSH
T18465237CA7DEA892F86D11730676A231360AB5B49B70C1DBD728B14EE4B0CD0D87E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f7972766b267730d5a8e5555a2a2e689952383cc453859791c483b3990802ea0
MD5 4827bfc94d05ea521dd17ead13b493b7
SHA1 ce10ccc3acf0ddd04487932750e712c422d1fdbb
SHA512 5edd163e4308cc36914bbbfe230299f68d77992bc4122449acdceddc7dc37b50c88f8141edf7b0701e0f62d8a33c44ccb0dfb863739c87d814bb8997543e7bac
SSDEEP 24576:rgb6bmBIi49WNNFpg1rSvFv7bYIyxknw4FYnshx8OfVe247:rgb4mBIBhGFkx4x8EVep
TLSH
T11B65AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 908f6b7b50df9763e433b114bb94f7c3feb2fb250444499d8d570789c28e2d61
MD5 216e5ae1be035df8f8171e4fbbe641b4
SHA1 644e9c4b27d7d662b6d05f715fd9a5aca3b04e0c
SHA512 e6bd0c60777b60179c35071484f95eaad92757a054bb8a54b2b478662df50cbd8f627821ec9dd8b2127f7cb82ce592591c90b188ff08cb8aaa07a5a62900294a
SSDEEP 24576:sG88u8FpJqH1Kzria7/mRyxknw4FYnshx8OfVe247:P7ZFPqVVa7/Dx4x8EVep
TLSH
T1C995F16877E101F1D47BD1388A924663F6B2B4250374EBDF07AC8A551F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 bd272f9717da81305274f90bd90a1e3b9fdcc0f8bf558bd8da7cf09590dc2084
MD5 d34988816f98bfa35cc641eac4e9f0f4
SHA1 dadd1a53a8a62238fcfb7217a7ee3a084a72eb2d
SHA512 12c25d116929aec3f1f22913d59df576c18f7e6d3caaaa18ebd64e8682f8fc7c66e79f34de05e94b2f3ac28ba97dc80114ec2f8fa05b0950a5310d578985f8f1
SSDEEP 12288:MHvUrBFrEjwaQl+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:MPUr+NQlyxknw4FYnshx8OfVe247
TLSH
T15975F12E22ED18E5E67AA17D89924319F771B4621711D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 77c5854f980404b22d19129c925472066befa3778f9cbf6721d02432873ce83f
MD5 29815a38480dadeaa7e560864a59b051
SHA1 ab60e613f420acb0abd9858d74283f0ceadb6181
SHA512 d31758a45b76179c4b476dcd08cd2fa71650f710fac039c5f3c82c2fab296d3cf8220986e07112ba2afa70185bdb3dffea0d89068fec87fe39ef2a61c3a22b01
SSDEEP 49152:/BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjgx4x8EVep:wG05lO43bxix8EVy
TLSH
T175D5CF6E62EC11F9D1BBD17CDAC6460BEBB23425033556CB02A486A91F23FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8d0b4fe19b81a4b2161f489d2ed195eeb788c0c759ff1af5078f3cff7915d952
MD5 3fa21eda10a88856f1a7b511d9058436
SHA1 8972067b33b8a1518ca6ddc7f156d1233efe3bd2
SHA512 f6ba7d75e38915c6e17b57a6771964c0fc770571a6701cdf4db6c2fbc0728b61b17bc4b1ffac9665f526cd9d4758418ef4d65824b492382495bb2262ff784696
SSDEEP 24576:Vfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnLyxknw4FYnshx8OfVe247:1a5POZ3+Jt2pasx2+mox4x8EVep
TLSH
T12365AF5DA6FC01D5E5B9D17DC583861AF5B1342153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5b9973835ef11edd0a35a80a89165278530e9d31534b138b41983d4aeaa2ffd1
MD5 74ff54fde7c46042358d514b61cb5767
SHA1 4ad2e461b7bf3fe8d2f5dccaee79c3a20e465f9a
SHA512 2d7b6c1679700816c3e74bc7147053026b2a13fcfeab62dc778b0af2af5deb63a34c5e68189c63a07888bbce23d0c9fa71bf23db9273e462b5fdbe3133047d0d
SSDEEP 24576:INcwHdjbyQ4nLC18lb/EOjowL7FkZyxknw4FYnshx8OfVe247:INc/zEOVHFjx4x8EVep
TLSH
T10E857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 902fb6095bc8e6307302a7d6b07469d1fcd615eb22e387099190dae75650d4e3
MD5 2d751c84e3e83547b927ff36543403a6
SHA1 43f2d21905642f394b56937d5e0492349746a5ec
SHA512 fbb38708d63922ce2a9742a55f726e21809ef3a12a66fc225895d7e907dcb1f7389b00b98dabfc07092ebd9e04d1fc65f390f22336d8ee11b3e58244f378317e
SSDEEP 24576:c8kNvNnaFeYhJNtmZBm3yxknw4FYnshx8OfVe247:c8MwBtOmCx4x8EVep
TLSH
T12855AF6EB6F846E4D1FEC6B58D238512E6727461073293CB8390C13E4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 749ba14fc26779b8f8d568eb059b25078297f8b9fcccce9b04bdc3778bbc47d4
MD5 8582ced7fa06701256365116fcbadd4d
SHA1 95caaccd68c570f31d7e0f8206f4b8853953300d
SHA512 c5aa2148d3f3295784261f4c12a3b4abbeddbb9408c849ad22570eb1e0d544f5852cbd3889a096b08fbba9c9d57ae9caa86d11b57b50aa84e66857b2a38d8ae6
SSDEEP 24576:iD3FHshBIYQgAOyxknw4FYnshx8OfVe247:iDVHeBIAABx4x8EVep
TLSH
T15E85E17DE79C04E4E57AC1BC8A638606E77138A9033256CB02D491BA5F67EE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/756-62-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/756-279-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/756-55-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/756-56-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/784-386-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/784-384-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/784-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/784-362-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/784-90-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/784-96-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/1548-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1548-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1548-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1548-372-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1608-383-0x000001CD6A6E0000-0x000001CD6A8AA000-memory.dmp

Download

memory/2520-108-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2520-109-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2520-367-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2520-103-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2520-370-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2520-369-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2744-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2744-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2744-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2744-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2744-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2980-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2980-15-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2980-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2980-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2980-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3024-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3024-128-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3024-134-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3024-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3024-136-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3132-116-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/3132-114-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3132-122-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/3132-371-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4072-68-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/4072-70-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4072-75-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4072-290-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/4124-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4124-39-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4124-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4124-53-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4124-48-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4240-66-0x0000000000400000-0x00000000005A1000-memory.dmp

Download

memory/4240-9-0x0000000000506000-0x0000000000507000-memory.dmp

Download

memory/4240-3-0x0000000000990000-0x00000000009F6000-memory.dmp

Download

memory/4240-0-0x0000000000400000-0x00000000005A1000-memory.dmp

Download

memory/4240-285-0x0000000000400000-0x00000000005A1000-memory.dmp

Download

memory/4240-2-0x0000000000990000-0x00000000009F6000-memory.dmp

Download

memory/4240-8-0x0000000000990000-0x00000000009F6000-memory.dmp

Download

memory/5244-85-0x00000000007A0000-0x0000000000806000-memory.dmp

Download

memory/5244-351-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/5244-80-0x00000000007A0000-0x0000000000806000-memory.dmp

Download

memory/5244-79-0x0000000000400000-0x0000000000563000-memory.dmp

Download